Skip to content
Indene
en

Artigos

September Studies Show Why Cyber Risk Should Be Reported as a Range, Not a Point Estimate

Cyber claims range from less than $1,000 to over $500 million, and fewer than 44% of organizations have a tested continuity plan (NetDiligence and Gartner, 2026). For the board, the average is not enough: decisions require a loss range supported by proven controls.

By Rafael LimaCFO

4 min read

Curva de perda assimétrica em traço fino sobre fundo claro, com o pico marcado em verde e a cauda longa à direita.
Curva de perda assimétrica em traço fino sobre fundo claro, com o pico marcado em verde e a cauda longa à direita.

Two surveys published in September 2026 measure the same thing from different angles. NetDiligence's annual claims study shows losses ranging from less than $1,000 to over half a billion dollars. Gartner reports that fewer than 44% of organizations have an updated and tested IT continuity plan. Together, they support a simple thesis: cyber risk cannot be captured by a single number, and the range the board needs to see only narrows when controls have been proven.

What the Studies Show

NetDiligence, a company that analyzes cyber insurance claims, published the 16th edition of its Cyber Claims Study on September 15, 2026. The database covers 10,309 claims from incidents that occurred between 2021 and 2025. A week later, on September 22, Gartner released highlights from the first day of the Security & Risk Management Summit in London.

Indicator Number Source
Claims analyzed 10,309, from incidents in 2021 to 2025 NetDiligence, 2026
Largest ransom demand in the series $500 million NetDiligence, 2026
Largest ransom paid in the series $90 million NetDiligence, 2026
Share of large companies 3% of claims and 56% of total cost NetDiligence, 2026
Share of companies with revenue below $2 billion 97% of claims and 44% of total cost NetDiligence, 2026
Organizations with an updated and tested IT continuity plan fewer than 44% Gartner, 2026
CISOs with at least one deepfake social engineering incident in 12 months 41% Gartner, 2026

Two numbers deserve attention. For companies with revenue below $2 billion, ransomware and business email compromise together accounted for more than half of 2025 claims, according to NetDiligence. And the company's president, Mark Greisiger, summarized the central finding in one sentence: "Every year, this study reminds us how wide the range of cyber loss really is."

At Gartner, analyst Christopher Mixter applied the same idea to strategy: "Resilience, not prevention, is the strategy."

What This Means Together

The first takeaway is about the average. When 3% of claims account for 56% of the cost, the average value per incident describes almost no one. It is too high for most and too low for the case that truly threatens the balance sheet. A board that approves a budget based on this number is making decisions about a company that does not exist.

The second takeaway is about the tail. Ransom demands of $500 million and payments of $90 million are rare, but they are in the series. For the CFO, the useful question is not "how much does an incident cost," but rather "what is the probable loss, what is the severe scenario, and with what confidence do we know this?" This is the language of risk appetite and tolerance that management already uses in credit and market risk.

The third takeaway links the two studies. The width of the range depends on what is known about the controls. A continuity plan that has never been tested is a declared control, not an evidenced one. If fewer than 44% of organizations have such a plan updated and tested, most are estimating downtime, and therefore the loss from ransomware, based on an unproven premise. The range is wide because the evidence is weak.

For institutions regulated by the Central Bank of Brazil, this is already a requirement. CMN Resolution 5,274, dated December 18, 2025, with a compliance deadline of March 1, 2026, treats continuity testing as a mandatory control and requires penetration testing at least once a year, performed by an independent professional, with documented results available to the Central Bank for five years, according to analyses by Grant Thornton and NDM Advogados. The same analyses indicate that continuity test results and relevant incidents must reach governance bodies.

The deepfake data completes the picture. Payment fraud via compromised email is one of the most common scenarios in claims from smaller companies, and 41% of CISOs surveyed by Gartner have already experienced at least one deepfake social engineering incident. Payment approval controls that rely on recognizing a voice or a face deserve to be tested again.

What to Do Now

  1. Replace the single number with a range in board reporting: probable loss, severe scenario, and the confidence level of the estimate.
  2. Test the IT continuity plan with an actual restore, record the date, owner, and measured time, and use that time in the ransomware loss estimate.
  3. Review payment approvals and changes to supplier bank details so they do not rely on voice, video, or email as the sole confirmation.
  4. Check the retention of evidence from penetration tests and continuity tests for the period required by regulation, with the origin and date of each piece of evidence.
  5. Compare the loss range with the cyber insurance policy limit and present the gap to the committee as a decision, not a footnote.

This is the logic behind Indene's public methodology: all exposure is presented in dollars, as a range, with the confidence of the evidence alongside it, and expired evidence widens the range without anyone needing to touch the number. Read the methodology.

References

Topics

Keep reading

All news